baidu-map-ios-sdk

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands for dependency management using pod install and for project verification using xcodebuild. This is used to ensure the SDK is correctly integrated and the project compiles successfully.
  • [EXTERNAL_DOWNLOADS]: The skill references and downloads external resources from official and well-known sources. It utilizes CocoaPods for library management and points to Baidu's official LBS domain lbsyun.baidu.com for SDK documentation and API keys. It also references gems.ruby-china.com for tool installation.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements an automated code-fixing loop that introduces a vulnerability surface.
  • Ingestion points: The agent is instructed to read and interpret stdout/stderr outputs from xcodebuild execution (described in SKILL.md).
  • Boundary markers: There are no specific delimiters or instructions to ignore malicious content embedded within build logs or third-party error messages.
  • Capability inventory: The agent has permissions to execute shell commands (xcodebuild, pod), modify project source code, and update configuration files like Info.plist.
  • Sanitization: No sanitization logic is provided to filter untrusted content from build outputs before it is used to inform code modification decisions.
  • [PRIVILEGE_ESCALATION]: The references/cocoapods.md file contains instructions for the user to perform environment setup using sudo gem install, which is a standard but sensitive operation for installing system-level software.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 02:04 AM